Container Security — Image scanning, runtime protection, and distroless builds

I once traced a container compromise back to a base image that hadn’t been updated in 847 days. The developer had pinned ubuntu:18.04…